feat(ai-guard): enable redaction tests in java

[manuel-alvarez-alvarez]

Motivation

Next version of the java tracer will add support for SDS redaction in the java tracer.

The tracer PR must land first.

Changes

Enable tests in the java manifest and update the java weblog to fully support the feature.

Workflow

1. ⚠️ Create your PR as draft ⚠️
2. Work on you PR until the CI passes
3. Mark it as ready for review
   • Test logic is modified? -> Get a review from RFC owner.
   • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

• Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
• A docker base image is modified?
  • the relevant build-XXX-image label is present
• A scenario is added, removed or renamed?
  • Get a review from R&P team

https://datadoghq.atlassian.net/browse/APPSEC-69390

[github-actions]

CODEOWNERS have been resolved as:

manifests/java.yml                                                      @DataDog/system-tests-reviewers
utils/build/docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/ai_guard/AIGuardController.java  @DataDog/system-tests-reviewers

[datadog-datadog-prod-us1]

 

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

Testing the test | System Tests (java, dev) / End-to-end #7 / spring-boot 7 — ❌ 40 tests failed · 🔧 Needs a code fix, caused by this PR

View more details · View in GitHub Actions

AssertionError: 'ai_guard.redacted' not set on the ai_guard span in tests/ai_guard/test_ai_guard_sdk.py:547.

Showing tests most relevant to this failure.

❌ tests.ai_guard.test_ai_guard_sdk.Test_NoRedaction.test_no_redaction_empty_replacements[spring-boot] from system_tests_suite

AssertionError: 'ai_guard.redacted' not set on the ai_guard span
assert None is not None

self = <tests.ai_guard.test_ai_guard_sdk.Test_NoRedaction object at 0x7ff5b2ccd820>

    def test_no_redaction_empty_replacements(self):
        """An explicitly empty redaction_replacements array is the same signal as an absent one."""
        assert self.r.status_code == 200
>       interfaces.library.validate_one_span(
            self.r, validator=_assert_redaction_scenario(self.scenario), full_trace=True
...

❌ tests.ai_guard.test_ai_guard_sdk.Test_NoRedaction.test_no_redaction_findings_only[spring-boot] from system_tests_suite

AssertionError: 'ai_guard.redacted' not set on the ai_guard span
assert None is not None

self = <tests.ai_guard.test_ai_guard_sdk.Test_NoRedaction object at 0x7ff5b2ccd9a0>

    def test_no_redaction_findings_only(self):
        """sds_findings without redaction_replacements: detection metadata never drives redaction.
    
        The findings are still reported, and the sensitive data they point at stays in place
        because the backend did not ask for it to be redacted.
...

❌ tests.ai_guard.test_ai_guard_sdk.Test_NoRedaction.test_no_redaction_single_message[spring-boot] from system_tests_suite

AssertionError: 'ai_guard.redacted' not set on the ai_guard span
assert None is not None

self = <tests.ai_guard.test_ai_guard_sdk.Test_NoRedaction object at 0x7ff5b2cce5a0>

    def test_no_redaction_single_message(self):
        """A benign single message is left untouched and returns no redaction_replacements."""
        assert self.r.status_code == 200
        body = json.loads(self.r.text)
        assert not body.get("redaction_replacements"), f"Unexpected redaction on benign message: {body}"
...

↳ and 37 more — View all

Testing the test | all-jobs-are-green

View more details · View in GitHub Actions

Job did not run. View full logs or trace.

📋 Copy fix prompt

CI on my pull request is failing. Help me find and fix the root cause of each failing job below — they were flagged as caused by changes in this PR, so focus on the diff. For each job, explain the failure and propose a fix.

Before you start, set up the Datadog software-delivery tooling so you can
query the CI data yourself:

1. Check whether you already have the Datadog software-delivery MCP tools
   (e.g. a `search_datadog_ci_pipeline_events` tool) and the `unblock-pr` skill.
2. If either is missing, STOP and ask me for permission before installing
   anything. Do not install or run anything until I have said yes.
3. Only with my explicit approval, set up the Datadog software-delivery MCP
   server and skills by following:
     https://docs.datadoghq.com/getting_started/software_delivery_mcp_tools/
   then restart so the skill is picked up.
4. If I decline, skip all of the above and work from the context below alone.

Then run /unblock-pr — it will pull the CI data itself. The job context below is what we already know.

If /unblock-pr is not available — because I declined the setup above, or it did not install — work from the context below instead.

Datadog has already classified this failure as caused by changes in this PR.
Take that as given and work the fix:

1. Locate the change. Diff this branch against its base and find the change
   that produces this error. Explain the mechanism, don't just name a file:
     git fetch origin && git diff $(git merge-base origin/main HEAD)...HEAD
2. Reproduce it locally. Run the failing job's command or test before
   proposing anything.
3. Propose the smallest fix that addresses the root cause — not a workaround,
   not a broadened assertion, not a disabled or skipped test.
4. Re-run the same command to confirm, and say exactly what you ran.
5. If the failure turns out to be intermittent rather than deterministic, say
   so plainly instead of "fixing" it — that is a flaky test, and patching it
   hides the problem.

If the right move is to re-run the job rather than change code, use the job
link in the context below. For GitHub Actions: `gh run rerun <run-id> --failed`,
where the run ID is the number after `/runs/` in that URL (not the trailing
number, which is the job ID).

Branch: malvarez/ai-guard-sds-redaction

Testing the test | System Tests (java, dev) / End-to-end #7 / spring-boot 7
Commit: 0167e77bc7fa5c1503ccaaa81bc60d4e118a8d8d
Error (code / test):
AssertionError: 'ai_guard.redacted' not set on the ai_guard span in tests/ai_guard/test_ai_guard_sdk.py:547.
CI job: https://github.com/DataDog/system-tests/actions/runs/33748230379/job/100629259252

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 499f091 | Docs | View more details | Give us feedback!}